test(desktop): isolate Rewind owner snapshot authority

[aryanorastar]

What changed and why

Addresses the Rewind/auth occurrence reported in #12039. The regression test changed auth_userId directly even though runtime owner authorization is process-wide and deliberately revokes out-of-band owner changes. That made the result depend on which owner-bound suite ran first and produced the observed anonymous versus auth-leading-… failure.

The test now recreates that revoked-authority state deliberately, then establishes and restores its owner through RuntimeOwnerAuthorityTestFixture. This follows the same serialized transition boundary as production and automatically places the suite in the runner's derived owner-isolation cluster.

Product invariants affected

none

How it was verified

• xcrun swift test --package-path desktop/macos/Desktop --filter 'RewindCaptureExclusionGenerationTests' — 9/9 passed.
• Repeated the exact contamination-recovery regression 50 times with --skip-build — 50/50 passed.
• Ran the full 5,769-test macOS Swift process three times. The repaired test passed under real process-order contamination in every run; each full run retained one unrelated baseline failure elsewhere, consistent with Desktop Swift Static & Test Contracts: four different test suites flaked in one afternoon #12039's broader multi-suite report.

This is test-harness isolation only; there is no user-facing path or physical-device behavior to exercise.

Tests

RewindCaptureExclusionGenerationTests.testOwnerSnapshotStaysCurrentWhenAuthLeadsUnresolvedRewindDatabase now starts from the exact revoked authority that previously arrived nondeterministically, then proves the auth-leading owner remains current while RewindDatabase.currentUserId is unresolved.

Failure class (fixes)

Failure-Class: FC-hand-listed-test-isolation-membership

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Git-on-my-level]

Thanks @aryanorastar — verified end to end against the current authorization implementation; this is a clean fix for the #12039 flake signature.

What I checked in desktop/macos/Desktop/Tests/RewindCaptureExclusionGenerationTests.swift:

• The rewrite matches production semantics: RuntimeOwnerAuthorizationAuthority fails closed on out-of-band auth_userId writes (revokeUnexpectedOwnerMismatch() in RuntimeOwnerIdentity.swift) and stays revoked until a real beginTransition/endTransition pair. So the old direct defaults.set(..., forKey: .authUserId) made the result depend on which owner-bound suite ran first — exactly the nondeterminism reported in Desktop Swift Static & Test Contracts: four different test suites flaked in one afternoon #12039.
• Nice touch: the test now asserts the revoked precondition explicitly (XCTAssertNil(RuntimeOwnerIdentity.captureAuthorizationSnapshot()) right after the out-of-band write) instead of assuming it, turning an order-dependent flake into a deterministic reproduction.
• Teardown via RuntimeOwnerAuthorityTestFixture.restore() is the right call — it re-enters through the production transition boundary, whereas raw defaults restoration would leave the process-wide authority revoked for subsequent suites (the exact cross-suite contamination the fixture was built to prevent).
• Confirmed swift-test-suites.sh auto-derives the sequential owner-isolation cluster by grepping test files for RuntimeOwnerAuthorityTestFixture, so this suite is now serialized with the other owner-bound suites as the description states.
• Desktop Swift Build & Tests, Static & Test Contracts, and Release Compile all pass on this head; the repeated-run verification in the description is appreciated.

Test-only change, no production behavior touched — leaving for human maintainer review before merge.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[kodjima33]

Test-isolation fix, low risk (test-file only, zero prod code touched), verified real and not already fixed. Bug-fix fast-lane heuristic scores 2/5 (below the 3/5 owner-override bar) and title doesn't match fix(desktop)/fix(macos)/fix(windows), so holding at approve rather than owner-override merge.

[aryanorastar]

@undivisible this one is ready for a merge press — approved by @kodjima33, all checks green, no conflicts. It just needs someone to click, since the bug-fix fast lane scored it 2/5 (below the 3/5 owner-override bar) and held at approve.

On the title: test(desktop): doesn't match the fix(desktop)/fix(macos)/fix(windows) pattern the fast lane looks for, and I deliberately didn't rename it to slip through. test: is the accurate Conventional Commits type for correcting a test, and the 2/5 score would have held it anyway — so renaming would have been gaming the heuristic without even working.

Two others in the same neighbourhood while you're here, both green with zero conflicts:

PR	What	State
#12288	web/app/bun.lock is missing the prettier deps 64db30c791 added to package.json, so bun install --frozen-lockfile fails on main	green — reproduces on a pristine main checkout; every PR touching web/app/src/** inherits a red Hygiene + Build until this lands
#12259	the same owner-authority flake as this PR, in FloatingBarNotificationPreviewPolicyTests — a suite #12039 doesn't name	green, 0 reviews

#12288 is the one I'd take first: it's six lines, it's a break on main rather than in any branch, and it's currently reddening #12262 for reasons that have nothing to do with that PR.

#12259 is worth a glance as a pair with this one — same root cause (RuntimeOwnerIdentity.swift:51 revoking on an out-of-band auth_userId write), same fix shape, and I proved it rather than assumed: identical command, same three owner-bound suites, 1 failure before and 0 failures after. Both suites pass 19/19 in isolation either way, which is exactly why the flake looked nondeterministic.

No rush on any of them.

[undivisible]

@undivisible this one is ready for a merge press — approved by @kodjima33, all checks green, no conflicts. It just needs someone to click, since the bug-fix fast lane scored it 2/5 (below the 3/5 owner-override bar) and held at approve.

On the title: test(desktop): doesn't match the fix(desktop)/fix(macos)/fix(windows) pattern the fast lane looks for, and I deliberately didn't rename it to slip through. test: is the accurate Conventional Commits type for correcting a test, and the 2/5 score would have held it anyway — so renaming would have been gaming the heuristic without even working.

Two others in the same neighbourhood while you're here, both green with zero conflicts:

PR	What	State
#12288	web/app/bun.lock is missing the prettier deps 64db30c791 added to package.json, so bun install --frozen-lockfile fails on main	green — reproduces on a pristine main checkout; every PR touching web/app/src/** inherits a red Hygiene + Build until this lands
#12259	the same owner-authority flake as this PR, in FloatingBarNotificationPreviewPolicyTests — a suite #12039 doesn't name	green, 0 reviews

#12288 is the one I'd take first: it's six lines, it's a break on main rather than in any branch, and it's currently reddening #12262 for reasons that have nothing to do with that PR.

#12259 is worth a glance as a pair with this one — same root cause (RuntimeOwnerIdentity.swift:51 revoking on an out-of-band auth_userId write), same fix shape, and I proved it rather than assumed: identical command, same three owner-bound suites, 1 failure before and 0 failures after. Both suites pass 19/19 in isolation either way, which is exactly why the flake looked nondeterministic.

No rush on any of them.

"merge my shit like a good boy" ahh guy

ok i will also idc if you kinda name shit a bit different its obvious that you can write test its all good

[aryanorastar]

@undivisible this one is ready for a merge press — approved by @kodjima33, all checks green, no conflicts. It just needs someone to click, since the bug-fix fast lane scored it 2/5 (below the 3/5 owner-override bar) and held at approve.
On the title: test(desktop): doesn't match the fix(desktop)/fix(macos)/fix(windows) pattern the fast lane looks for, and I deliberately didn't rename it to slip through. test: is the accurate Conventional Commits type for correcting a test, and the 2/5 score would have held it anyway — so renaming would have been gaming the heuristic without even working.
Two others in the same neighbourhood while you're here, both green with zero conflicts:

PR
What
State

#12288
web/app/bun.lock is missing the prettier deps 64db30c791 added to package.json, so bun install --frozen-lockfile fails on main
green — reproduces on a pristine main checkout; every PR touching web/app/src/** inherits a red Hygiene + Build until this lands

#12259
the same owner-authority flake as this PR, in FloatingBarNotificationPreviewPolicyTests — a suite #12039 doesn't name
green, 0 reviews

#12288 is the one I'd take first: it's six lines, it's a break on main rather than in any branch, and it's currently reddening #12262 for reasons that have nothing to do with that PR.
#12259 is worth a glance as a pair with this one — same root cause (RuntimeOwnerIdentity.swift:51 revoking on an out-of-band auth_userId write), same fix shape, and I proved it rather than assumed: identical command, same three owner-bound suites, 1 failure before and 0 failures after. Both suites pass 19/19 in isolation either way, which is exactly why the flake looked nondeterministic.
No rush on any of them.

"merge my shit like a good boy" ahh guy

ok i will also idc if you kinda name shit a bit different its obvious that you can write test its all good

i was trying to reach you on discord wanna learn a lot from you my id is astar6969 @undivisible